Overview of the current implementation status of the NIS 2 directive across EU countries with a map and summaries of national transposition progress.
What is the NIS 2 directive?
The NIS 2 directive is a comprehensive revision of the original NIS Directive from 2016 and aims to raise cybersecurity standards across the EU. Key features include:
- Expanded scope to additional sectors
- Stricter security requirements
- Improved incident reporting obligations
- Applicability to a wide range of “essential” and “important” entities across sectors
EU Member States are required to transpose NIS 2 into national law by 17 October 2024. For many countries this entails significant changes to national cybersecurity laws and governance structures.
Overview of the NIS 2 implementation status in the EU
The map below illustrated the implementation status of the NIS 2 directive in EU Member States as of 17 October 2024. Countries are grouped into four categories indicated by different colors:
- Red: No (public) draft known. Examples include France, Spain and Ireland.
- Orange: Draft is in (public) discussion. Includes countries such as Sweden, the Netherlands and Poland.
- Blue: Draft is in parliamentary voting. Includes Germany, Austria, Finland and Italy.
- Green: Law already adopted. This applies to Belgium, Greece and some eastern European states.
The map shows that implementation progress varies widely across the EU. While some countries are well advanced, others remain at early stages of the process. This highlights the challenge of achieving uniform implementation across the Union.
Countries that have already adopted a law
Seven countries have already adopted national laws to implement the NIS 2 directive:
- Belgium
- Italy
- Croatia
- Latvia
- Lithuania
- Romania
- Hungary
Countries with a law or draft
Twelve countries have submitted drafts that are either in public discussion or already in the legislative process:
- Denmark
- Germany
- Finland
- Luxembourg
- Netherlands
- Austria
- Poland
- Sweden
- Slovakia
- Slovenia
- Czech Republic
- Cyprus
Countries without a public draft
For seven countries no public draft is currently known:
- Bulgaria
- Estonia
- France
- Greece
- Malta
- Portugal
- Spain
Detailed country overview of the NIS 2 implementation
The table below provides a detailed overview of the current implementation status of the NIS 2 directive in all EU Member States. For each country the current status is indicated and, where available, direct links to the relevant legal texts or drafts are provided.
Implementation status (as of 17.10.2024)
Please note that the implementation status is a snapshot as of the specified date and may change rapidly due to the dynamic nature of the legislative process.
Support for implementing the NIS 2 directive
Implementing the NIS 2 directive is a complex challenge for many organizations. Our experienced cybersecurity team provides comprehensive support for transposition of this important directive. We can help with:
- Conducting gap analyses to identify required actions
- Developing tailored implementation strategies
- Training your staff on NIS 2 requirements
- Supporting the establishment of effective risk management and reporting processes
We understand the specific challenges of different industries and tailor our advisory services to your needs. Our aim is not only to help you comply with NIS 2 requirements but also to strengthen your overall cybersecurity resilience.
Contact us for a non-binding initial consultation in which we will jointly determine how we can assist you in implementing the NIS 2 directive efficiently and effectively.
Conclusion
The transposition of the NIS 2 directive across EU Member States shows clear progress but remains uneven. While some countries have already adopted laws, others are still at early stages. Most states recognize the need for stronger cybersecurity measures and are actively working on implementation. Nevertheless, meeting the deadline and achieving uniform transposition by October 2024 remains a significant challenge.
It is expected that countries still in early phases will intensify their efforts in the coming months to meet the deadline. Progress in the various Member States will continue to be closely monitored to ensure a high common level of cybersecurity across the EU.
Note: This overview reflects the status as of 17 October 2024. Given the dynamic nature of legislative processes, information may change quickly. Please always refer to official sources for the most current information.